62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56

Analysis

max time kernel
202s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:09

Target

62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
Size

522KB
MD5

e07f32f1f203005dce6d5650b390d20c
SHA1

b8d8ecb8ed78c5109731908d8820d4e10b59f3c8
SHA256

62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56
SHA512

03b9b2ca49fb7636e83f7141e55091ca8fff54b1478860443f2b8fa6fbb119b73b61040b3a10ba6ead7f6b74ce1049091e33952d002a194bea60d62542869e84
SSDEEP

6144:aAOmqkq9k6Al3CglARvm7z+iZ+/tmw8afHlMu3e/LCj39BzBb8bmQy1CrxQqD9R4:CAq9eAb3/t92/cB+y18xQqpx8O5p

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe

description	pid	process	target process
PID 3196 wrote to memory of 4232	3196	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
PID 3196 wrote to memory of 4232	3196	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
PID 3196 wrote to memory of 4232	3196	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
PID 3196 wrote to memory of 1364	3196	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
PID 3196 wrote to memory of 1364	3196	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
PID 3196 wrote to memory of 1364	3196	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe	62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe

C:\Users\Admin\AppData\Local\Temp\62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
"C:\Users\Admin\AppData\Local\Temp\62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
  start
  2⤵
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\62da8ecf01aae7a4a1080aaa139bb1c36ceacaf71d01850973c49ae133047a56.exe
  watch
  2⤵
  PID:1364

memory/1364-134-0x0000000000000000-mapping.dmp

Download
memory/1364-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1364-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1364-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3196-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3196-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3196-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4232-135-0x0000000000000000-mapping.dmp

Download
memory/4232-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4232-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4232-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download